Add CVSS 3.1 severity for GHSA-xj5v-6v4g-jfw6

[sunnypatell]

Changes

Added CVSS 3.1 scoring to GHSA-xj5v-6v4g-jfw6 (Rack DoS via crafted Range header).

• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5 High)

CVSS justification

• AV:N - exploitable via HTTP requests to any Rack-based application
• AC:L/PR:N/UI:N - unauthenticated attacker can send a crafted Range header with no special setup
• A:H - malicious Range headers cause unexpectedly large responses, exhausting server memory/bandwidth

References

• NVD: CVE-2024-26141
• Security advisory
• Fix commit (3.0.x)

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[yhidad31]

Hello @sunnypatell. The GitHub Advisory Database Team includes both CVSS 4.0 and 3.1 scores in advisories only when both values have been provided by the CVE-assigning CNA. We do not combine NVD scores with CNA scores. Therefore, we will close this pull request and will not accept the contribution.